# Check that an evidence export is genuine

Every consent evidence export from ComplyZero is signed by us and carries a fingerprint for every file and every record. Whoever you hand it to can re-check all of it themselves, with Seal Check at complyzero.com/seal-check or with the free verifier, so an auditor or a court doesn't have to take your word for it.

## Make an export

You make exports in the dashboard: in the **Evidence Vault**, which lists every export, or where the consent records are, on a website's **Consent Records** page or the **Records** tab of **People** under **Consent Hub**. Select **New export**. Choose the period, and if you like a website, an action or a purpose, then select **Request export**.

When the export shows **Ready**, select **Download**. Downloads are available for 14 days. Exporting needs permission to export evidence, which the Owner and Administrators have.

Send the ZIP file exactly as you downloaded it. Don't unzip and re-zip it: the check accepts only the file as we wrote it, so a repacked file can't be checked even when nothing inside changed.

## Check it with Seal Check

### 1. Open the check page

Go to [Seal Check](https://www.complyzero.com/seal-check) and drop the ZIP file on the page, or select **Choose a file**. It's free, and there's no account to make.

### 2. Read the result

The page shows one of three results:

- **Intact**: the export was signed by ComplyZero and hasn't changed since. Every file and every record matches its fingerprint.
- **Altered**: something was changed, removed or added. The page names the file, record or profile where the check failed.
- **Can't check**: the file isn't a ComplyZero export, is damaged, was unzipped and zipped again, or is signed with a key that isn't ours. Ask the sender for the original download.

Under the result, the page lists what the signed manifest says (the kind of export, the period, the number of records, and the organisation and website IDs) and each check it ran.

### 3. Match the file to your export list

The result shows the **File fingerprint (SHA-256)**. Compare it with the **ZIP fingerprint (SHA-256)** under **How to check it** beside the export in ComplyZero (in the Evidence Vault, or where you requested it), or with the fingerprint the sender gave you, to be sure it's the file you meant.

## Check it offline

The same checks run as one script on your own computer. You need Node.js 20 or later and the verifier: [download verify-evidence-package.mjs](https://dashboard.complyzero.com/evidence-verifier/verify-evidence-package.mjs). For the same file, the script and the check page reach the same result.

### 4. Run the verifier on the export

Open a terminal in the folder with both files and run:

```sh
node verify-evidence-package.mjs consent-export-7KQ2.zip
```

To check without a connection, first download [our public signing keys](https://api.complyzero.com/.well-known/complyzero-evidence-keys.json), then add `--keys complyzero-evidence-keys.json`. Online, `--refresh` fetches the latest keys before checking.

### 5. Read the result

The last line reads **Result: verified.** when everything passes:

- **Signature**: the export was signed by ComplyZero and hasn't changed since.
- **Layout and files**: every file is present, in order, with the right fingerprint and size.
- **Records**: every record's fingerprint matches its contents.
- **Versions**: every purpose, notice and form version the records cite is included.

If anything was changed, removed or added, the check fails and names the first problem. The third line, **Package SHA-256**, is the file's fingerprint to match against your export list. **How to check it** in ComplyZero also shows the exact command to run.

## What it proves, and what it doesn't

The check proves the export is exactly what ComplyZero issued, and that no record inside it was altered, removed or slipped in since. It doesn't prove when the export was made, or anything about records outside the range you exported.

For every detail of the format, the checks and how we look after the signing keys, read [How Seal Check works](https://www.complyzero.com/docs/developers/how-seal-check-works).

Last checked against the ComplyZero dashboard on 2026-10-26. Source: https://www.complyzero.com/docs/developers/check-an-evidence-export